CVE-2024-31979

Apache StreamPipes: Possibility of SSRF in pipeline element installation process

CVSS 7.5 HIGHEPSS 0.7%CWE-918

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

17 Jul 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Apache Software Foundation · Apache StreamPipes

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://lists.apache.org/thread/8lryp3bxnby9kmk13odkz2jbfdjfvf0y http://www.openwall.com/lists/oss-security/2024/07/16/11